@opengeni/artifact-tool 0.2.2

package/dist/chunk-ZCJYRJGB.js

@@ -0,0 +1,489 @@
+import {
+  ARTIFACT_RUNTIME_ENVIRONMENT,
+  ArtifactRuntimeError,
+  loadArtifactKernelRuntime,
+  locateArtifactRuntimeDependencies,
+  resolveArtifactRuntimeTarget,
+  validateArtifactRuntimeInstallationManifest,
+  validateCompleteArtifactRuntimeReleaseManifest
+} from "./chunk-N2IHNWBS.js";
+
+// src/runtime-cli.ts
+import { createHash } from "crypto";
+import { open, realpath, stat } from "fs/promises";
+import { isAbsolute, relative, resolve } from "path";
+import { fileURLToPath, pathToFileURL } from "url";
+var MAX_INSTALLATION_MANIFEST_BYTES = 256 * 1024;
+var MAX_RELEASE_MANIFEST_BYTES = 1024 * 1024;
+var MAX_ARTIFACT_TOOL_ARCHIVE_BYTES = 256 * 1024 * 1024;
+var MAX_JAVASCRIPT_ENTRYPOINT_BYTES = 32 * 1024 * 1024;
+var MAX_SKILL_FACADE_SUPPORT_FILE_BYTES = 128 * 1024 * 1024;
+var MAX_KERNEL_ASSET_BYTES = 512 * 1024 * 1024;
+async function locateVerifiedArtifactRuntime(options = {}) {
+  const environment = options.environment ?? process.env;
+  const manifestInput = requiredEnvironmentPath(environment, ARTIFACT_RUNTIME_ENVIRONMENT.manifest);
+  const facadeInput = requiredEnvironmentPath(
+    environment,
+    ARTIFACT_RUNTIME_ENVIRONMENT.toolEntrypoint
+  );
+  const expectedTarget = options.expectedTarget ?? resolveCurrentArtifactRuntimeTarget();
+  const manifestPath = await canonicalFile(manifestInput, "installation manifest");
+  const installationFile = await readInstallationManifest(manifestPath);
+  const installation = installationFile.manifest;
+  const dependencies = locateArtifactRuntimeDependencies(
+    installation,
+    pathToFileURL(manifestPath),
+    expectedTarget
+  );
+  assertCanonicalInstallationManifest(installationFile.bytes, dependencies.manifest);
+  const installationRoot = await realpath(resolve(manifestPath, ".."));
+  const releaseManifestPath = await confinedCanonicalFile(
+    dependencies.releaseManifestUrl,
+    installationRoot,
+    "release manifest"
+  );
+  const artifactToolArchive = dependencies.artifactToolArchiveUrl ? await confinedCanonicalFile(
+    dependencies.artifactToolArchiveUrl,
+    installationRoot,
+    "artifact-tool archive"
+  ) : void 0;
+  const skillFacadeEntrypoint = await confinedCanonicalFile(
+    dependencies.skillFacadeEntrypoint,
+    installationRoot,
+    "skill facade entrypoint"
+  );
+  const skillFacadeSupportFiles = await Promise.all(
+    dependencies.skillFacadeSupportFiles.map(
+      (url, index) => confinedCanonicalFile(url, installationRoot, `skill facade support file ${index}`)
+    )
+  );
+  const kernelEntrypoint = await confinedCanonicalFile(
+    dependencies.kernelEntrypoint,
+    installationRoot,
+    "kernel entrypoint"
+  );
+  const kernelAsset = await confinedCanonicalFile(
+    dependencies.kernelAsset,
+    installationRoot,
+    "kernel asset"
+  );
+  const kernelSupportFiles = await Promise.all(
+    dependencies.kernelSupportFiles.map(
+      (url, index) => confinedCanonicalFile(url, installationRoot, `kernel support file ${index}`)
+    )
+  );
+  const configuredFacade = await canonicalFile(facadeInput, "configured skill facade entrypoint");
+  if (configuredFacade !== skillFacadeEntrypoint) {
+    integrity(
+      `${ARTIFACT_RUNTIME_ENVIRONMENT.toolEntrypoint} does not name the manifest-pinned skill facade entrypoint`
+    );
+  }
+  const releaseBytes = await readAndVerifyFile(
+    releaseManifestPath,
+    installation.releaseManifest,
+    MAX_RELEASE_MANIFEST_BYTES,
+    "release manifest"
+  );
+  const release = parseReleaseManifest(releaseBytes);
+  assertCanonicalReleaseManifest(releaseBytes, release);
+  if (!sameJson(release.artifactTool, installation.artifactTool)) {
+    integrity("Installed artifact-tool identity does not match the complete release manifest");
+  }
+  if (artifactToolArchive && installation.artifactToolArchive) {
+    const archiveBytes = await readAndVerifyFile(
+      artifactToolArchive,
+      installation.artifactToolArchive,
+      MAX_ARTIFACT_TOOL_ARCHIVE_BYTES,
+      "artifact-tool archive"
+    );
+    const archiveIntegrity = `sha512-${createHash("sha512").update(archiveBytes).digest("base64")}`;
+    if (archiveIntegrity !== installation.artifactTool.integrity) {
+      integrity("Packed artifact-tool archive differs from its installation identity");
+    }
+  }
+  const releasedKernel = release.targets.find((entry) => entry.target === installation.target);
+  if (!releasedKernel || !sameJson(releasedKernel, installation.kernel)) {
+    integrity("Installed kernel package does not match its exact release target manifest");
+  }
+  await verifyFile(
+    skillFacadeEntrypoint,
+    installation.skillFacadeEntrypoint,
+    MAX_JAVASCRIPT_ENTRYPOINT_BYTES,
+    "skill facade entrypoint"
+  );
+  for (const [index, path] of skillFacadeSupportFiles.entries()) {
+    await verifyFile(
+      path,
+      installation.skillFacadeSupportFiles[index],
+      MAX_SKILL_FACADE_SUPPORT_FILE_BYTES,
+      `skill facade support file ${index}`
+    );
+  }
+  await verifyFile(
+    kernelEntrypoint,
+    installation.kernel.entrypoint,
+    MAX_JAVASCRIPT_ENTRYPOINT_BYTES,
+    "kernel entrypoint"
+  );
+  await verifyFile(kernelAsset, installation.kernel.asset, MAX_KERNEL_ASSET_BYTES, "kernel asset");
+  for (const [index, path] of kernelSupportFiles.entries()) {
+    await verifyFile(
+      path,
+      installation.kernel.supportFiles[index],
+      MAX_JAVASCRIPT_ENTRYPOINT_BYTES,
+      `kernel support file ${index}`
+    );
+  }
+  return Object.freeze({
+    schemaVersion: 1,
+    target: installation.target,
+    manifestPath,
+    releaseManifestPath,
+    artifactTool: Object.freeze({ ...installation.artifactTool }),
+    ...artifactToolArchive ? { artifactToolArchive } : {},
+    skillFacadeEntrypoint,
+    ...skillFacadeSupportFiles.length > 0 ? { skillFacadeSupportFiles: Object.freeze([...skillFacadeSupportFiles]) } : {},
+    kernel: Object.freeze({
+      packageName: installation.kernel.packageName,
+      packageVersion: installation.kernel.packageVersion,
+      entrypoint: kernelEntrypoint,
+      asset: kernelAsset,
+      supportFiles: Object.freeze([...kernelSupportFiles]),
+      buildIdentity: installation.kernel.buildIdentity
+    })
+  });
+}
+async function doctorVerifiedArtifactRuntime(options = {}) {
+  const location = await locateVerifiedArtifactRuntime(options);
+  const importer = options.importer ?? defaultImporter;
+  let imported;
+  try {
+    imported = await importer(pathToFileURL(location.skillFacadeEntrypoint).href);
+  } catch (cause) {
+    throw new ArtifactRuntimeError(
+      "ARTIFACT_RUNTIME_UNAVAILABLE",
+      "Verified skill facade bootstrap could not be evaluated",
+      { cause }
+    );
+  }
+  if (typeof imported !== "object" || imported === null || Array.isArray(imported)) {
+    incompatible("skill facade bootstrap did not export a module namespace");
+  }
+  const module = imported;
+  if (options.probe) {
+    await options.probe(module);
+  } else {
+    probeVerifiedArtifactSkillFacade(module, location);
+  }
+  return location;
+}
+async function loadVerifiedArtifactKernelRuntime(options = {}) {
+  const environment = options.environment ?? process.env;
+  const expectedTarget = options.expectedTarget ?? resolveCurrentArtifactRuntimeTarget();
+  const before = await locateVerifiedArtifactRuntime({ environment, expectedTarget });
+  const installation = (await readInstallationManifest(before.manifestPath)).manifest;
+  const dependencies = locateArtifactRuntimeDependencies(
+    installation,
+    pathToFileURL(before.manifestPath),
+    expectedTarget
+  );
+  const runtime = await loadArtifactKernelRuntime(dependencies);
+  const after = await locateVerifiedArtifactRuntime({ environment, expectedTarget });
+  if (!sameJson(before, after) || runtime.kind !== "native" || runtime.target !== before.target || runtime.buildIdentity !== before.kernel.buildIdentity) {
+    integrity("Loaded kernel runtime does not match the verified installation");
+  }
+  return Object.freeze({ location: after, runtime });
+}
+function canonicalArtifactRuntimeReleaseManifestBytes(value) {
+  const manifest = validateCompleteArtifactRuntimeReleaseManifest(value);
+  return new TextEncoder().encode(`${JSON.stringify(manifest, null, 2)}
+`);
+}
+function canonicalArtifactRuntimeInstallationManifestBytes(value) {
+  const manifest = validateArtifactRuntimeInstallationManifest(value);
+  return new TextEncoder().encode(`${JSON.stringify(manifest, null, 2)}
+`);
+}
+function resolveCurrentArtifactRuntimeTarget() {
+  const platform = process.platform;
+  const arch = process.arch;
+  if (platform !== "linux") {
+    return resolveArtifactRuntimeTarget({ platform, arch }).target;
+  }
+  return resolveArtifactRuntimeTarget({ platform, arch, libc: detectLinuxLibc() }).target;
+}
+async function runArtifactRuntimeCli(args, environment = process.env) {
+  const [command, format, ...rest] = args;
+  if (command !== "locate" && command !== "doctor" || format !== "--json" || rest.length > 0) {
+    throw new ArtifactRuntimeError("ARTIFACT_RUNTIME_MANIFEST_INVALID", artifactRuntimeCliUsage());
+  }
+  const location = command === "doctor" ? await doctorVerifiedArtifactRuntime({ environment }) : await locateVerifiedArtifactRuntime({ environment });
+  return `${JSON.stringify(location)}
+`;
+}
+function artifactRuntimeCliUsage() {
+  return "Usage: opengeni-artifact-runtime <locate|doctor> --json";
+}
+async function readInstallationManifest(path) {
+  const bytes = await readBoundedFile(
+    path,
+    MAX_INSTALLATION_MANIFEST_BYTES,
+    "installation manifest"
+  );
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch (cause) {
+    throw new ArtifactRuntimeError(
+      "ARTIFACT_RUNTIME_MANIFEST_INVALID",
+      "Installation manifest is not strict UTF-8 JSON",
+      { cause }
+    );
+  }
+  return Object.freeze({
+    manifest: parsed,
+    bytes
+  });
+}
+function parseReleaseManifest(bytes) {
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch (cause) {
+    throw new ArtifactRuntimeError(
+      "ARTIFACT_RUNTIME_MANIFEST_INVALID",
+      "Release manifest is not strict UTF-8 JSON",
+      { cause }
+    );
+  }
+  return validateCompleteArtifactRuntimeReleaseManifest(parsed);
+}
+function assertCanonicalReleaseManifest(actual, manifest) {
+  const canonical = canonicalArtifactRuntimeReleaseManifestBytes(manifest);
+  if (!sameBytes(actual, canonical)) {
+    integrity("Release manifest bytes are not in the canonical deterministic form");
+  }
+}
+function assertCanonicalInstallationManifest(actual, manifest) {
+  const canonical = canonicalArtifactRuntimeInstallationManifestBytes(manifest);
+  if (!sameBytes(actual, canonical)) {
+    integrity("Installation manifest bytes are not in the canonical deterministic form");
+  }
+}
+async function confinedCanonicalFile(url, root, name) {
+  const path = await canonicalFile(fileURLToPath(url), name);
+  const fromRoot = relative(root, path);
+  if (fromRoot === ".." || fromRoot.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute(fromRoot)) {
+    throw new ArtifactRuntimeError(
+      "ARTIFACT_RUNTIME_MANIFEST_INVALID",
+      `${name} resolves outside the installation root`
+    );
+  }
+  return path;
+}
+async function canonicalFile(input, name) {
+  if (!isAbsolute(input)) {
+    throw new ArtifactRuntimeError(
+      "ARTIFACT_RUNTIME_MANIFEST_INVALID",
+      `${name} path must be absolute`
+    );
+  }
+  try {
+    const path = await realpath(input);
+    const metadata = await stat(path);
+    if (!metadata.isFile()) unavailable(`${name} is not a regular file`);
+    return path;
+  } catch (cause) {
+    if (cause instanceof ArtifactRuntimeError) throw cause;
+    throw new ArtifactRuntimeError("ARTIFACT_RUNTIME_UNAVAILABLE", `${name} is not available`, {
+      cause
+    });
+  }
+}
+async function readBoundedFile(path, maximumBytes, name) {
+  let handle;
+  try {
+    handle = await open(path, "r");
+    const before = await handle.stat();
+    if (!before.isFile()) unavailable(`${name} is not a regular file`);
+    if (before.size <= 0 || before.size > maximumBytes) {
+      integrity(`${name} size is outside its allowed bound`);
+    }
+    const bytes = new Uint8Array(await handle.readFile());
+    const after = await handle.stat();
+    if (after.size !== before.size || bytes.byteLength !== before.size) {
+      integrity(`${name} changed while it was being read`);
+    }
+    return bytes;
+  } catch (cause) {
+    if (cause instanceof ArtifactRuntimeError) throw cause;
+    throw new ArtifactRuntimeError("ARTIFACT_RUNTIME_UNAVAILABLE", `Could not read ${name}`, {
+      cause
+    });
+  } finally {
+    await handle?.close();
+  }
+}
+async function readAndVerifyFile(path, expected, maximumBytes, name) {
+  if (expected.bytes > maximumBytes) integrity(`${name} exceeds its allowed bound`);
+  const bytes = await readBoundedFile(path, maximumBytes, name);
+  if (bytes.byteLength !== expected.bytes)
+    integrity(`${name} byte count does not match its manifest`);
+  const digest = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+  if (digest !== expected.sha256) integrity(`${name} digest does not match its manifest`);
+  return bytes;
+}
+async function verifyFile(path, expected, maximumBytes, name) {
+  if (expected.bytes > maximumBytes) integrity(`${name} exceeds its allowed bound`);
+  let handle;
+  try {
+    handle = await open(path, "r");
+    const before = await handle.stat();
+    if (!before.isFile()) unavailable(`${name} is not a regular file`);
+    if (before.size !== expected.bytes) integrity(`${name} byte count does not match its manifest`);
+    const hash = createHash("sha256");
+    let bytes = 0;
+    for await (const chunk of handle.createReadStream({ autoClose: false })) {
+      const buffer = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+      bytes += buffer.byteLength;
+      if (bytes > maximumBytes || bytes > expected.bytes) integrity(`${name} exceeds its manifest`);
+      hash.update(buffer);
+    }
+    const after = await handle.stat();
+    if (after.size !== before.size || bytes !== before.size)
+      integrity(`${name} changed while hashing`);
+    const digest = `sha256:${hash.digest("hex")}`;
+    if (digest !== expected.sha256) integrity(`${name} digest does not match its manifest`);
+  } catch (cause) {
+    if (cause instanceof ArtifactRuntimeError) throw cause;
+    throw new ArtifactRuntimeError("ARTIFACT_RUNTIME_UNAVAILABLE", `Could not verify ${name}`, {
+      cause
+    });
+  } finally {
+    await handle?.close();
+  }
+}
+function requiredEnvironmentPath(environment, name) {
+  const value = environment[name];
+  if (typeof value !== "string" || value.length === 0) {
+    unavailable(`${name} is required; runtime discovery never downloads or guesses an asset`);
+  }
+  return value;
+}
+function resolveLinuxLibcFromRuntimeEvidence(evidence) {
+  const candidates = /* @__PURE__ */ new Set();
+  if (nonempty(evidence.versions.musl)) candidates.add("musl");
+  if (nonempty(evidence.report?.header?.glibcVersionRuntime)) candidates.add("gnu");
+  if (Array.isArray(evidence.report?.sharedObjects) && evidence.report.sharedObjects.some(
+    (entry) => typeof entry === "string" && /(?:^|[\\/])ld-musl-(?:aarch64|x86_64)\.so(?:\.\d+)?$/u.test(entry)
+  )) {
+    candidates.add("musl");
+  }
+  const bunArchiveLibc = libcFromOfficialBunRelease(
+    evidence.report?.header?.release?.sourceUrl,
+    evidence.versions.bun,
+    evidence.arch
+  );
+  if (bunArchiveLibc) candidates.add(bunArchiveLibc);
+  if (candidates.size === 1) return [...candidates][0];
+  throw new ArtifactRuntimeError(
+    "ARTIFACT_RUNTIME_UNSUPPORTED_TARGET",
+    "Could not prove whether this Linux host uses glibc or musl"
+  );
+}
+function detectLinuxLibc() {
+  const report = process.report?.getReport();
+  return resolveLinuxLibcFromRuntimeEvidence({
+    arch: process.arch,
+    versions: process.versions,
+    ...report ? { report } : {}
+  });
+}
+function libcFromOfficialBunRelease(sourceUrl, bunVersion, arch) {
+  if (!nonempty(sourceUrl) || !nonempty(bunVersion)) return void 0;
+  let url;
+  try {
+    url = new URL(sourceUrl);
+  } catch {
+    return void 0;
+  }
+  if (url.protocol !== "https:" || url.hostname !== "github.com" || url.username || url.password || url.search || url.hash) {
+    return void 0;
+  }
+  const match = /^\/oven-sh\/bun\/releases\/download\/bun-v([^/]+)\/bun-linux-([^/]+)\.zip$/u.exec(
+    url.pathname
+  );
+  if (!match || match[1] !== bunVersion) return void 0;
+  const archiveTarget = match[2];
+  const validTarget = arch === "arm64" ? /^aarch64(?:-musl)?(?:-profile)?$/u.test(archiveTarget) : arch === "x64" ? /^x64(?:-musl)?(?:-baseline)?(?:-profile)?$/u.test(archiveTarget) : false;
+  if (!validTarget) return void 0;
+  return archiveTarget.split("-").includes("musl") ? "musl" : "gnu";
+}
+function nonempty(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function probeVerifiedArtifactSkillFacade(module, location) {
+  const getRuntime = module.getConfiguredArtifactRuntime;
+  if (typeof getRuntime !== "function") {
+    incompatible("skill facade bootstrap does not expose getConfiguredArtifactRuntime()");
+  }
+  const runtime = getRuntime();
+  if (typeof runtime !== "object" || runtime === null) {
+    incompatible("skill facade bootstrap did not configure its exact native runtime");
+  }
+  const record = runtime;
+  if (record.kind !== "native" || record.target !== location.target || record.buildIdentity !== location.kernel.buildIdentity || typeof record.capabilities !== "object" || record.capabilities === null) {
+    incompatible("skill facade bootstrap configured an incompatible runtime");
+  }
+  const workbookFactory = module.Workbook;
+  const diagnostics = module.getArtifactCompositeDiagnostics;
+  const snapshot = module.createArtifactSnapshot;
+  const dispose = module.disposeArtifact;
+  if (typeof workbookFactory?.create !== "function" || typeof diagnostics !== "function" || typeof snapshot !== "function" || typeof dispose !== "function") {
+    incompatible("skill facade bootstrap is missing its native workbook health surface");
+  }
+  const workbook = workbookFactory.create();
+  try {
+    const proof = diagnostics(workbook);
+    if (proof.runtimeTarget !== location.target || proof.runtimeBuildIdentity !== location.kernel.buildIdentity || typeof proof.nativeStateHash !== "string") {
+      incompatible("skill facade workbook health proof does not match the pinned runtime");
+    }
+  } finally {
+    dispose(workbook);
+  }
+}
+function defaultImporter(specifier) {
+  return import(
+    /* @vite-ignore */
+    specifier
+  );
+}
+function sameJson(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+function sameBytes(left, right) {
+  if (left.byteLength !== right.byteLength) return false;
+  return left.every((value, index) => value === right[index]);
+}
+function integrity(message) {
+  throw new ArtifactRuntimeError("ARTIFACT_RUNTIME_INTEGRITY", message);
+}
+function unavailable(message) {
+  throw new ArtifactRuntimeError("ARTIFACT_RUNTIME_UNAVAILABLE", message);
+}
+function incompatible(message) {
+  throw new ArtifactRuntimeError("ARTIFACT_RUNTIME_INCOMPATIBLE", message);
+}
+
+export {
+  locateVerifiedArtifactRuntime,
+  doctorVerifiedArtifactRuntime,
+  loadVerifiedArtifactKernelRuntime,
+  canonicalArtifactRuntimeReleaseManifestBytes,
+  canonicalArtifactRuntimeInstallationManifestBytes,
+  resolveCurrentArtifactRuntimeTarget,
+  runArtifactRuntimeCli,
+  resolveLinuxLibcFromRuntimeEvidence,
+  probeVerifiedArtifactSkillFacade
+};
+//# sourceMappingURL=chunk-ZCJYRJGB.js.map

package/dist/chunk-ZCJYRJGB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/runtime-cli.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport { createHash } from \"node:crypto\";\nimport { open, realpath, stat } from \"node:fs/promises\";\nimport { isAbsolute, relative, resolve } from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\nimport {\n  ARTIFACT_RUNTIME_ENVIRONMENT,\n  ArtifactRuntimeError,\n  loadArtifactKernelRuntime,\n  locateArtifactRuntimeDependencies,\n  resolveArtifactRuntimeTarget,\n  validateArtifactRuntimeInstallationManifest,\n  validateCompleteArtifactRuntimeReleaseManifest,\n  type ArtifactKernelRuntime,\n  type ArtifactRuntimeInstallationManifest,\n  type ArtifactRuntimeTarget,\n} from \"./runtime\";\n\nconst MAX_INSTALLATION_MANIFEST_BYTES = 256 * 1024;\nconst MAX_RELEASE_MANIFEST_BYTES = 1024 * 1024;\nconst MAX_ARTIFACT_TOOL_ARCHIVE_BYTES = 256 * 1024 * 1024;\nconst MAX_JAVASCRIPT_ENTRYPOINT_BYTES = 32 * 1024 * 1024;\nconst MAX_SKILL_FACADE_SUPPORT_FILE_BYTES = 128 * 1024 * 1024;\nconst MAX_KERNEL_ASSET_BYTES = 512 * 1024 * 1024;\n\ntype RuntimeEnvironment = Readonly<Record<string, string | undefined>>;\n\nexport type VerifiedArtifactRuntimeLocation = Readonly<{\n  schemaVersion: 1;\n  target: ArtifactRuntimeTarget;\n  manifestPath: string;\n  releaseManifestPath: string;\n  artifactTool: Readonly<{\n    packageName: \"@opengeni/artifact-tool\";\n    packageVersion: string;\n    integrity: `sha512-${string}`;\n  }>;\n  artifactToolArchive?: string;\n  skillFacadeEntrypoint: string;\n  skillFacadeSupportFiles?: readonly string[];\n  kernel: Readonly<{\n    packageName: string;\n    packageVersion: string;\n    entrypoint: string;\n    asset: string;\n    supportFiles: readonly string[];\n    buildIdentity: string;\n  }>;\n}>;\n\nexport type LocateArtifactRuntimeOptions = Readonly<{\n  environment?: RuntimeEnvironment;\n  /** Test/build override. The executable always derives the current host target. */\n  expectedTarget?: ArtifactRuntimeTarget;\n}>;\n\nexport type DoctorArtifactRuntimeOptions = LocateArtifactRuntimeOptions &\n  Readonly<{\n    importer?: (specifier: string) => unknown | Promise<unknown>;\n    probe?: (module: Record<string, unknown>) => void | Promise<void>;\n  }>;\n\nexport type VerifiedArtifactKernelRuntime = Readonly<{\n  location: VerifiedArtifactRuntimeLocation;\n  runtime: ArtifactKernelRuntime;\n}>;\n\n/**\n * Verifies the complete local release/install chain without evaluating any\n * package code. All reads are local, bounded, streamed where large, and pinned\n * to exact byte counts plus SHA-256 digests.\n */\nexport async function locateVerifiedArtifactRuntime(\n  options: LocateArtifactRuntimeOptions = {},\n): Promise<VerifiedArtifactRuntimeLocation> {\n  const environment = options.environment ?? process.env;\n  const manifestInput = requiredEnvironmentPath(environment, ARTIFACT_RUNTIME_ENVIRONMENT.manifest);\n  const facadeInput = requiredEnvironmentPath(\n    environment,\n    ARTIFACT_RUNTIME_ENVIRONMENT.toolEntrypoint,\n  );\n  const expectedTarget = options.expectedTarget ?? resolveCurrentArtifactRuntimeTarget();\n\n  const manifestPath = await canonicalFile(manifestInput, \"installation manifest\");\n  const installationFile = await readInstallationManifest(manifestPath);\n  const installation = installationFile.manifest;\n  const dependencies = locateArtifactRuntimeDependencies(\n    installation,\n    pathToFileURL(manifestPath),\n    expectedTarget,\n  );\n  assertCanonicalInstallationManifest(installationFile.bytes, dependencies.manifest);\n  const installationRoot = await realpath(resolve(manifestPath, \"..\"));\n\n  const releaseManifestPath = await confinedCanonicalFile(\n    dependencies.releaseManifestUrl,\n    installationRoot,\n    \"release manifest\",\n  );\n  const artifactToolArchive = dependencies.artifactToolArchiveUrl\n    ? await confinedCanonicalFile(\n        dependencies.artifactToolArchiveUrl,\n        installationRoot,\n        \"artifact-tool archive\",\n      )\n    : undefined;\n  const skillFacadeEntrypoint = await confinedCanonicalFile(\n    dependencies.skillFacadeEntrypoint,\n    installationRoot,\n    \"skill facade entrypoint\",\n  );\n  const skillFacadeSupportFiles = await Promise.all(\n    dependencies.skillFacadeSupportFiles.map((url, index) =>\n      confinedCanonicalFile(url, installationRoot, `skill facade support file ${index}`),\n    ),\n  );\n  const kernelEntrypoint = await confinedCanonicalFile(\n    dependencies.kernelEntrypoint,\n    installationRoot,\n    \"kernel entrypoint\",\n  );\n  const kernelAsset = await confinedCanonicalFile(\n    dependencies.kernelAsset,\n    installationRoot,\n    \"kernel asset\",\n  );\n  const kernelSupportFiles = await Promise.all(\n    dependencies.kernelSupportFiles.map((url, index) =>\n      confinedCanonicalFile(url, installationRoot, `kernel support file ${index}`),\n    ),\n  );\n  const configuredFacade = await canonicalFile(facadeInput, \"configured skill facade entrypoint\");\n  if (configuredFacade !== skillFacadeEntrypoint) {\n    integrity(\n      `${ARTIFACT_RUNTIME_ENVIRONMENT.toolEntrypoint} does not name the manifest-pinned skill facade entrypoint`,\n    );\n  }\n\n  const releaseBytes = await readAndVerifyFile(\n    releaseManifestPath,\n    installation.releaseManifest,\n    MAX_RELEASE_MANIFEST_BYTES,\n    \"release manifest\",\n  );\n  const release = parseReleaseManifest(releaseBytes);\n  assertCanonicalReleaseManifest(releaseBytes, release);\n  if (!sameJson(release.artifactTool, installation.artifactTool)) {\n    integrity(\"Installed artifact-tool identity does not match the complete release manifest\");\n  }\n  if (artifactToolArchive && installation.artifactToolArchive) {\n    const archiveBytes = await readAndVerifyFile(\n      artifactToolArchive,\n      installation.artifactToolArchive,\n      MAX_ARTIFACT_TOOL_ARCHIVE_BYTES,\n      \"artifact-tool archive\",\n    );\n    const archiveIntegrity = `sha512-${createHash(\"sha512\").update(archiveBytes).digest(\"base64\")}`;\n    if (archiveIntegrity !== installation.artifactTool.integrity) {\n      integrity(\"Packed artifact-tool archive differs from its installation identity\");\n    }\n  }\n  const releasedKernel = release.targets.find((entry) => entry.target === installation.target);\n  if (!releasedKernel || !sameJson(releasedKernel, installation.kernel)) {\n    integrity(\"Installed kernel package does not match its exact release target manifest\");\n  }\n\n  // Do not evaluate the facade or kernel package until every executable/data\n  // file in the chain has independently passed its byte proof.\n  await verifyFile(\n    skillFacadeEntrypoint,\n    installation.skillFacadeEntrypoint,\n    MAX_JAVASCRIPT_ENTRYPOINT_BYTES,\n    \"skill facade entrypoint\",\n  );\n  for (const [index, path] of skillFacadeSupportFiles.entries()) {\n    await verifyFile(\n      path,\n      installation.skillFacadeSupportFiles![index]!,\n      MAX_SKILL_FACADE_SUPPORT_FILE_BYTES,\n      `skill facade support file ${index}`,\n    );\n  }\n  await verifyFile(\n    kernelEntrypoint,\n    installation.kernel.entrypoint,\n    MAX_JAVASCRIPT_ENTRYPOINT_BYTES,\n    \"kernel entrypoint\",\n  );\n  await verifyFile(kernelAsset, installation.kernel.asset, MAX_KERNEL_ASSET_BYTES, \"kernel asset\");\n  for (const [index, path] of kernelSupportFiles.entries()) {\n    await verifyFile(\n      path,\n      installation.kernel.supportFiles[index]!,\n      MAX_JAVASCRIPT_ENTRYPOINT_BYTES,\n      `kernel support file ${index}`,\n    );\n  }\n\n  return Object.freeze({\n    schemaVersion: 1,\n    target: installation.target,\n    manifestPath,\n    releaseManifestPath,\n    artifactTool: Object.freeze({ ...installation.artifactTool }),\n    ...(artifactToolArchive ? { artifactToolArchive } : {}),\n    skillFacadeEntrypoint,\n    ...(skillFacadeSupportFiles.length > 0\n      ? { skillFacadeSupportFiles: Object.freeze([...skillFacadeSupportFiles]) }\n      : {}),\n    kernel: Object.freeze({\n      packageName: installation.kernel.packageName,\n      packageVersion: installation.kernel.packageVersion,\n      entrypoint: kernelEntrypoint,\n      asset: kernelAsset,\n      supportFiles: Object.freeze([...kernelSupportFiles]),\n      buildIdentity: installation.kernel.buildIdentity,\n    }),\n  });\n}\n\n/** Verify first, then evaluate the one pinned bootstrap and probe its facade. */\nexport async function doctorVerifiedArtifactRuntime(\n  options: DoctorArtifactRuntimeOptions = {},\n): Promise<VerifiedArtifactRuntimeLocation> {\n  const location = await locateVerifiedArtifactRuntime(options);\n  const importer = options.importer ?? defaultImporter;\n  let imported: unknown;\n  try {\n    imported = await importer(pathToFileURL(location.skillFacadeEntrypoint).href);\n  } catch (cause) {\n    throw new ArtifactRuntimeError(\n      \"ARTIFACT_RUNTIME_UNAVAILABLE\",\n      \"Verified skill facade bootstrap could not be evaluated\",\n      { cause },\n    );\n  }\n  if (typeof imported !== \"object\" || imported === null || Array.isArray(imported)) {\n    incompatible(\"skill facade bootstrap did not export a module namespace\");\n  }\n  const module = imported as Record<string, unknown>;\n  if (options.probe) {\n    await options.probe(module);\n  } else {\n    probeVerifiedArtifactSkillFacade(module, location);\n  }\n  return location;\n}\n\n/**\n * Loads only the manifest-pinned native kernel package after verifying every\n * selected runtime byte. A second complete verification after evaluation\n * closes ordinary replacement races; production additionally mounts this\n * installation read-only inside the materializer sandbox.\n */\nexport async function loadVerifiedArtifactKernelRuntime(\n  options: LocateArtifactRuntimeOptions = {},\n): Promise<VerifiedArtifactKernelRuntime> {\n  const environment = options.environment ?? process.env;\n  const expectedTarget = options.expectedTarget ?? resolveCurrentArtifactRuntimeTarget();\n  const before = await locateVerifiedArtifactRuntime({ environment, expectedTarget });\n  const installation = (await readInstallationManifest(before.manifestPath)).manifest;\n  const dependencies = locateArtifactRuntimeDependencies(\n    installation,\n    pathToFileURL(before.manifestPath),\n    expectedTarget,\n  );\n  const runtime = await loadArtifactKernelRuntime(dependencies);\n  const after = await locateVerifiedArtifactRuntime({ environment, expectedTarget });\n  if (\n    !sameJson(before, after) ||\n    runtime.kind !== \"native\" ||\n    runtime.target !== before.target ||\n    runtime.buildIdentity !== before.kernel.buildIdentity\n  ) {\n    integrity(\"Loaded kernel runtime does not match the verified installation\");\n  }\n  return Object.freeze({ location: after, runtime });\n}\n\n/** Deterministic bytes used by release tooling and verified by the locator. */\nexport function canonicalArtifactRuntimeReleaseManifestBytes(value: unknown): Uint8Array {\n  const manifest = validateCompleteArtifactRuntimeReleaseManifest(value);\n  return new TextEncoder().encode(`${JSON.stringify(manifest, null, 2)}\\n`);\n}\n\n/** Deterministic installation bytes; the strict locator rejects other encodings. */\nexport function canonicalArtifactRuntimeInstallationManifestBytes(value: unknown): Uint8Array {\n  const manifest = validateArtifactRuntimeInstallationManifest(value);\n  return new TextEncoder().encode(`${JSON.stringify(manifest, null, 2)}\\n`);\n}\n\nexport function resolveCurrentArtifactRuntimeTarget(): ArtifactRuntimeTarget {\n  const platform = process.platform;\n  const arch = process.arch;\n  if (platform !== \"linux\") {\n    return resolveArtifactRuntimeTarget({ platform, arch }).target;\n  }\n  return resolveArtifactRuntimeTarget({ platform, arch, libc: detectLinuxLibc() }).target;\n}\n\nexport async function runArtifactRuntimeCli(\n  args: readonly string[],\n  environment: RuntimeEnvironment = process.env,\n): Promise<string> {\n  const [command, format, ...rest] = args;\n  if ((command !== \"locate\" && command !== \"doctor\") || format !== \"--json\" || rest.length > 0) {\n    throw new ArtifactRuntimeError(\"ARTIFACT_RUNTIME_MANIFEST_INVALID\", artifactRuntimeCliUsage());\n  }\n  const location =\n    command === \"doctor\"\n      ? await doctorVerifiedArtifactRuntime({ environment })\n      : await locateVerifiedArtifactRuntime({ environment });\n  return `${JSON.stringify(location)}\\n`;\n}\n\nfunction artifactRuntimeCliUsage(): string {\n  return \"Usage: opengeni-artifact-runtime <locate|doctor> --json\";\n}\n\nasync function readInstallationManifest(\n  path: string,\n): Promise<Readonly<{ manifest: ArtifactRuntimeInstallationManifest; bytes: Uint8Array }>> {\n  const bytes = await readBoundedFile(\n    path,\n    MAX_INSTALLATION_MANIFEST_BYTES,\n    \"installation manifest\",\n  );\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes));\n  } catch (cause) {\n    throw new ArtifactRuntimeError(\n      \"ARTIFACT_RUNTIME_MANIFEST_INVALID\",\n      \"Installation manifest is not strict UTF-8 JSON\",\n      { cause },\n    );\n  }\n  // locateArtifactRuntimeDependencies performs the exact schema validation.\n  return Object.freeze({\n    manifest: parsed as ArtifactRuntimeInstallationManifest,\n    bytes,\n  });\n}\n\nfunction parseReleaseManifest(\n  bytes: Uint8Array,\n): ReturnType<typeof validateCompleteArtifactRuntimeReleaseManifest> {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes));\n  } catch (cause) {\n    throw new ArtifactRuntimeError(\n      \"ARTIFACT_RUNTIME_MANIFEST_INVALID\",\n      \"Release manifest is not strict UTF-8 JSON\",\n      { cause },\n    );\n  }\n  return validateCompleteArtifactRuntimeReleaseManifest(parsed);\n}\n\nfunction assertCanonicalReleaseManifest(\n  actual: Uint8Array,\n  manifest: ReturnType<typeof validateCompleteArtifactRuntimeReleaseManifest>,\n): void {\n  const canonical = canonicalArtifactRuntimeReleaseManifestBytes(manifest);\n  if (!sameBytes(actual, canonical)) {\n    integrity(\"Release manifest bytes are not in the canonical deterministic form\");\n  }\n}\n\nfunction assertCanonicalInstallationManifest(\n  actual: Uint8Array,\n  manifest: ArtifactRuntimeInstallationManifest,\n): void {\n  const canonical = canonicalArtifactRuntimeInstallationManifestBytes(manifest);\n  if (!sameBytes(actual, canonical)) {\n    integrity(\"Installation manifest bytes are not in the canonical deterministic form\");\n  }\n}\n\nasync function confinedCanonicalFile(url: URL, root: string, name: string): Promise<string> {\n  const path = await canonicalFile(fileURLToPath(url), name);\n  const fromRoot = relative(root, path);\n  if (\n    fromRoot === \"..\" ||\n    fromRoot.startsWith(`..${process.platform === \"win32\" ? \"\\\\\" : \"/\"}`) ||\n    isAbsolute(fromRoot)\n  ) {\n    throw new ArtifactRuntimeError(\n      \"ARTIFACT_RUNTIME_MANIFEST_INVALID\",\n      `${name} resolves outside the installation root`,\n    );\n  }\n  return path;\n}\n\nasync function canonicalFile(input: string, name: string): Promise<string> {\n  if (!isAbsolute(input)) {\n    throw new ArtifactRuntimeError(\n      \"ARTIFACT_RUNTIME_MANIFEST_INVALID\",\n      `${name} path must be absolute`,\n    );\n  }\n  try {\n    const path = await realpath(input);\n    const metadata = await stat(path);\n    if (!metadata.isFile()) unavailable(`${name} is not a regular file`);\n    return path;\n  } catch (cause) {\n    if (cause instanceof ArtifactRuntimeError) throw cause;\n    throw new ArtifactRuntimeError(\"ARTIFACT_RUNTIME_UNAVAILABLE\", `${name} is not available`, {\n      cause,\n    });\n  }\n}\n\nasync function readBoundedFile(\n  path: string,\n  maximumBytes: number,\n  name: string,\n): Promise<Uint8Array> {\n  let handle;\n  try {\n    handle = await open(path, \"r\");\n    const before = await handle.stat();\n    if (!before.isFile()) unavailable(`${name} is not a regular file`);\n    if (before.size <= 0 || before.size > maximumBytes) {\n      integrity(`${name} size is outside its allowed bound`);\n    }\n    const bytes = new Uint8Array(await handle.readFile());\n    const after = await handle.stat();\n    if (after.size !== before.size || bytes.byteLength !== before.size) {\n      integrity(`${name} changed while it was being read`);\n    }\n    return bytes;\n  } catch (cause) {\n    if (cause instanceof ArtifactRuntimeError) throw cause;\n    throw new ArtifactRuntimeError(\"ARTIFACT_RUNTIME_UNAVAILABLE\", `Could not read ${name}`, {\n      cause,\n    });\n  } finally {\n    await handle?.close();\n  }\n}\n\nasync function readAndVerifyFile(\n  path: string,\n  expected: Readonly<{ bytes: number; sha256: `sha256:${string}` }>,\n  maximumBytes: number,\n  name: string,\n): Promise<Uint8Array> {\n  if (expected.bytes > maximumBytes) integrity(`${name} exceeds its allowed bound`);\n  const bytes = await readBoundedFile(path, maximumBytes, name);\n  if (bytes.byteLength !== expected.bytes)\n    integrity(`${name} byte count does not match its manifest`);\n  const digest = `sha256:${createHash(\"sha256\").update(bytes).digest(\"hex\")}`;\n  if (digest !== expected.sha256) integrity(`${name} digest does not match its manifest`);\n  return bytes;\n}\n\nasync function verifyFile(\n  path: string,\n  expected: Readonly<{ bytes: number; sha256: `sha256:${string}` }>,\n  maximumBytes: number,\n  name: string,\n): Promise<void> {\n  if (expected.bytes > maximumBytes) integrity(`${name} exceeds its allowed bound`);\n  let handle;\n  try {\n    handle = await open(path, \"r\");\n    const before = await handle.stat();\n    if (!before.isFile()) unavailable(`${name} is not a regular file`);\n    if (before.size !== expected.bytes) integrity(`${name} byte count does not match its manifest`);\n    const hash = createHash(\"sha256\");\n    let bytes = 0;\n    for await (const chunk of handle.createReadStream({ autoClose: false })) {\n      const buffer = typeof chunk === \"string\" ? Buffer.from(chunk) : chunk;\n      bytes += buffer.byteLength;\n      if (bytes > maximumBytes || bytes > expected.bytes) integrity(`${name} exceeds its manifest`);\n      hash.update(buffer);\n    }\n    const after = await handle.stat();\n    if (after.size !== before.size || bytes !== before.size)\n      integrity(`${name} changed while hashing`);\n    const digest = `sha256:${hash.digest(\"hex\")}`;\n    if (digest !== expected.sha256) integrity(`${name} digest does not match its manifest`);\n  } catch (cause) {\n    if (cause instanceof ArtifactRuntimeError) throw cause;\n    throw new ArtifactRuntimeError(\"ARTIFACT_RUNTIME_UNAVAILABLE\", `Could not verify ${name}`, {\n      cause,\n    });\n  } finally {\n    await handle?.close();\n  }\n}\n\nfunction requiredEnvironmentPath(environment: RuntimeEnvironment, name: string): string {\n  const value = environment[name];\n  if (typeof value !== \"string\" || value.length === 0) {\n    unavailable(`${name} is required; runtime discovery never downloads or guesses an asset`);\n  }\n  return value;\n}\n\nexport type LinuxLibcRuntimeEvidence = Readonly<{\n  arch: string;\n  versions: Readonly<Record<string, string | undefined>>;\n  report?: Readonly<{\n    header?: Readonly<{\n      glibcVersionRuntime?: unknown;\n      release?: Readonly<{ sourceUrl?: unknown }>;\n    }>;\n    sharedObjects?: unknown;\n  }>;\n}>;\n\n/** Resolves only mutually consistent evidence about the running Linux binary. */\nexport function resolveLinuxLibcFromRuntimeEvidence(\n  evidence: LinuxLibcRuntimeEvidence,\n): \"gnu\" | \"musl\" {\n  const candidates = new Set<\"gnu\" | \"musl\">();\n  if (nonempty(evidence.versions.musl)) candidates.add(\"musl\");\n  if (nonempty(evidence.report?.header?.glibcVersionRuntime)) candidates.add(\"gnu\");\n  if (\n    Array.isArray(evidence.report?.sharedObjects) &&\n    evidence.report.sharedObjects.some(\n      (entry) =>\n        typeof entry === \"string\" &&\n        /(?:^|[\\\\/])ld-musl-(?:aarch64|x86_64)\\.so(?:\\.\\d+)?$/u.test(entry),\n    )\n  ) {\n    candidates.add(\"musl\");\n  }\n  const bunArchiveLibc = libcFromOfficialBunRelease(\n    evidence.report?.header?.release?.sourceUrl,\n    evidence.versions.bun,\n    evidence.arch,\n  );\n  if (bunArchiveLibc) candidates.add(bunArchiveLibc);\n  if (candidates.size === 1) return [...candidates][0]!;\n  throw new ArtifactRuntimeError(\n    \"ARTIFACT_RUNTIME_UNSUPPORTED_TARGET\",\n    \"Could not prove whether this Linux host uses glibc or musl\",\n  );\n}\n\nfunction detectLinuxLibc(): \"gnu\" | \"musl\" {\n  const report = process.report?.getReport() as LinuxLibcRuntimeEvidence[\"report\"];\n  return resolveLinuxLibcFromRuntimeEvidence({\n    arch: process.arch,\n    versions: process.versions as Record<string, string | undefined>,\n    ...(report ? { report } : {}),\n  });\n}\n\nfunction libcFromOfficialBunRelease(\n  sourceUrl: unknown,\n  bunVersion: string | undefined,\n  arch: string,\n): \"gnu\" | \"musl\" | undefined {\n  if (!nonempty(sourceUrl) || !nonempty(bunVersion)) return undefined;\n  let url: URL;\n  try {\n    url = new URL(sourceUrl);\n  } catch {\n    return undefined;\n  }\n  if (\n    url.protocol !== \"https:\" ||\n    url.hostname !== \"github.com\" ||\n    url.username ||\n    url.password ||\n    url.search ||\n    url.hash\n  ) {\n    return undefined;\n  }\n  const match = /^\\/oven-sh\\/bun\\/releases\\/download\\/bun-v([^/]+)\\/bun-linux-([^/]+)\\.zip$/u.exec(\n    url.pathname,\n  );\n  if (!match || match[1] !== bunVersion) return undefined;\n  const archiveTarget = match[2]!;\n  const validTarget =\n    arch === \"arm64\"\n      ? /^aarch64(?:-musl)?(?:-profile)?$/u.test(archiveTarget)\n      : arch === \"x64\"\n        ? /^x64(?:-musl)?(?:-baseline)?(?:-profile)?$/u.test(archiveTarget)\n        : false;\n  if (!validTarget) return undefined;\n  return archiveTarget.split(\"-\").includes(\"musl\") ? \"musl\" : \"gnu\";\n}\n\nfunction nonempty(value: unknown): value is string {\n  return typeof value === \"string\" && value.length > 0;\n}\n\nexport function probeVerifiedArtifactSkillFacade(\n  module: Record<string, unknown>,\n  location: Pick<VerifiedArtifactRuntimeLocation, \"target\" | \"kernel\">,\n): void {\n  const getRuntime = module.getConfiguredArtifactRuntime;\n  if (typeof getRuntime !== \"function\") {\n    incompatible(\"skill facade bootstrap does not expose getConfiguredArtifactRuntime()\");\n  }\n  const runtime = getRuntime();\n  if (typeof runtime !== \"object\" || runtime === null) {\n    incompatible(\"skill facade bootstrap did not configure its exact native runtime\");\n  }\n  const record = runtime as Record<string, unknown>;\n  if (\n    record.kind !== \"native\" ||\n    record.target !== location.target ||\n    record.buildIdentity !== location.kernel.buildIdentity ||\n    typeof record.capabilities !== \"object\" ||\n    record.capabilities === null\n  ) {\n    incompatible(\"skill facade bootstrap configured an incompatible runtime\");\n  }\n  const workbookFactory = module.Workbook as { create?: () => unknown } | undefined;\n  const diagnostics = module.getArtifactCompositeDiagnostics;\n  const snapshot = module.createArtifactSnapshot;\n  const dispose = module.disposeArtifact;\n  if (\n    typeof workbookFactory?.create !== \"function\" ||\n    typeof diagnostics !== \"function\" ||\n    typeof snapshot !== \"function\" ||\n    typeof dispose !== \"function\"\n  ) {\n    incompatible(\"skill facade bootstrap is missing its native workbook health surface\");\n  }\n  const workbook = workbookFactory.create();\n  try {\n    const proof = diagnostics(workbook) as Record<string, unknown>;\n    if (\n      proof.runtimeTarget !== location.target ||\n      proof.runtimeBuildIdentity !== location.kernel.buildIdentity ||\n      typeof proof.nativeStateHash !== \"string\"\n    ) {\n      incompatible(\"skill facade workbook health proof does not match the pinned runtime\");\n    }\n  } finally {\n    dispose(workbook);\n  }\n}\n\nfunction defaultImporter(specifier: string): Promise<unknown> {\n  return import(/* @vite-ignore */ specifier);\n}\n\nfunction sameJson(left: unknown, right: unknown): boolean {\n  return JSON.stringify(left) === JSON.stringify(right);\n}\n\nfunction sameBytes(left: Uint8Array, right: Uint8Array): boolean {\n  if (left.byteLength !== right.byteLength) return false;\n  return left.every((value, index) => value === right[index]);\n}\n\nfunction integrity(message: string): never {\n  throw new ArtifactRuntimeError(\"ARTIFACT_RUNTIME_INTEGRITY\", message);\n}\n\nfunction unavailable(message: string): never {\n  throw new ArtifactRuntimeError(\"ARTIFACT_RUNTIME_UNAVAILABLE\", message);\n}\n\nfunction incompatible(message: string): never {\n  throw new ArtifactRuntimeError(\"ARTIFACT_RUNTIME_INCOMPATIBLE\", message);\n}\n"],"mappings":";;;;;;;;;;;AAEA,SAAS,kBAAkB;AAC3B,SAAS,MAAM,UAAU,YAAY;AACrC,SAAS,YAAY,UAAU,eAAe;AAC9C,SAAS,eAAe,qBAAqB;AAc7C,IAAM,kCAAkC,MAAM;AAC9C,IAAM,6BAA6B,OAAO;AAC1C,IAAM,kCAAkC,MAAM,OAAO;AACrD,IAAM,kCAAkC,KAAK,OAAO;AACpD,IAAM,sCAAsC,MAAM,OAAO;AACzD,IAAM,yBAAyB,MAAM,OAAO;AAiD5C,eAAsB,8BACpB,UAAwC,CAAC,GACC;AAC1C,QAAM,cAAc,QAAQ,eAAe,QAAQ;AACnD,QAAM,gBAAgB,wBAAwB,aAAa,6BAA6B,QAAQ;AAChG,QAAM,cAAc;AAAA,IAClB;AAAA,IACA,6BAA6B;AAAA,EAC/B;AACA,QAAM,iBAAiB,QAAQ,kBAAkB,oCAAoC;AAErF,QAAM,eAAe,MAAM,cAAc,eAAe,uBAAuB;AAC/E,QAAM,mBAAmB,MAAM,yBAAyB,YAAY;AACpE,QAAM,eAAe,iBAAiB;AACtC,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,cAAc,YAAY;AAAA,IAC1B;AAAA,EACF;AACA,sCAAoC,iBAAiB,OAAO,aAAa,QAAQ;AACjF,QAAM,mBAAmB,MAAM,SAAS,QAAQ,cAAc,IAAI,CAAC;AAEnE,QAAM,sBAAsB,MAAM;AAAA,IAChC,aAAa;AAAA,IACb;AAAA,IACA;AAAA,EACF;AACA,QAAM,sBAAsB,aAAa,yBACrC,MAAM;AAAA,IACJ,aAAa;AAAA,IACb;AAAA,IACA;AAAA,EACF,IACA;AACJ,QAAM,wBAAwB,MAAM;AAAA,IAClC,aAAa;AAAA,IACb;AAAA,IACA;AAAA,EACF;AACA,QAAM,0BAA0B,MAAM,QAAQ;AAAA,IAC5C,aAAa,wBAAwB;AAAA,MAAI,CAAC,KAAK,UAC7C,sBAAsB,KAAK,kBAAkB,6BAA6B,KAAK,EAAE;AAAA,IACnF;AAAA,EACF;AACA,QAAM,mBAAmB,MAAM;AAAA,IAC7B,aAAa;AAAA,IACb;AAAA,IACA;AAAA,EACF;AACA,QAAM,cAAc,MAAM;AAAA,IACxB,aAAa;AAAA,IACb;AAAA,IACA;AAAA,EACF;AACA,QAAM,qBAAqB,MAAM,QAAQ;AAAA,IACvC,aAAa,mBAAmB;AAAA,MAAI,CAAC,KAAK,UACxC,sBAAsB,KAAK,kBAAkB,uBAAuB,KAAK,EAAE;AAAA,IAC7E;AAAA,EACF;AACA,QAAM,mBAAmB,MAAM,cAAc,aAAa,oCAAoC;AAC9F,MAAI,qBAAqB,uBAAuB;AAC9C;AAAA,MACE,GAAG,6BAA6B,cAAc;AAAA,IAChD;AAAA,EACF;AAEA,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAU,qBAAqB,YAAY;AACjD,iCAA+B,cAAc,OAAO;AACpD,MAAI,CAAC,SAAS,QAAQ,cAAc,aAAa,YAAY,GAAG;AAC9D,cAAU,+EAA+E;AAAA,EAC3F;AACA,MAAI,uBAAuB,aAAa,qBAAqB;AAC3D,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA,aAAa;AAAA,MACb;AAAA,MACA;AAAA,IACF;AACA,UAAM,mBAAmB,UAAU,WAAW,QAAQ,EAAE,OAAO,YAAY,EAAE,OAAO,QAAQ,CAAC;AAC7F,QAAI,qBAAqB,aAAa,aAAa,WAAW;AAC5D,gBAAU,qEAAqE;AAAA,IACjF;AAAA,EACF;AACA,QAAM,iBAAiB,QAAQ,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,aAAa,MAAM;AAC3F,MAAI,CAAC,kBAAkB,CAAC,SAAS,gBAAgB,aAAa,MAAM,GAAG;AACrE,cAAU,2EAA2E;AAAA,EACvF;AAIA,QAAM;AAAA,IACJ;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,EACF;AACA,aAAW,CAAC,OAAO,IAAI,KAAK,wBAAwB,QAAQ,GAAG;AAC7D,UAAM;AAAA,MACJ;AAAA,MACA,aAAa,wBAAyB,KAAK;AAAA,MAC3C;AAAA,MACA,6BAA6B,KAAK;AAAA,IACpC;AAAA,EACF;AACA,QAAM;AAAA,IACJ;AAAA,IACA,aAAa,OAAO;AAAA,IACpB;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW,aAAa,aAAa,OAAO,OAAO,wBAAwB,cAAc;AAC/F,aAAW,CAAC,OAAO,IAAI,KAAK,mBAAmB,QAAQ,GAAG;AACxD,UAAM;AAAA,MACJ;AAAA,MACA,aAAa,OAAO,aAAa,KAAK;AAAA,MACtC;AAAA,MACA,uBAAuB,KAAK;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO,OAAO,OAAO;AAAA,IACnB,eAAe;AAAA,IACf,QAAQ,aAAa;AAAA,IACrB;AAAA,IACA;AAAA,IACA,cAAc,OAAO,OAAO,EAAE,GAAG,aAAa,aAAa,CAAC;AAAA,IAC5D,GAAI,sBAAsB,EAAE,oBAAoB,IAAI,CAAC;AAAA,IACrD;AAAA,IACA,GAAI,wBAAwB,SAAS,IACjC,EAAE,yBAAyB,OAAO,OAAO,CAAC,GAAG,uBAAuB,CAAC,EAAE,IACvE,CAAC;AAAA,IACL,QAAQ,OAAO,OAAO;AAAA,MACpB,aAAa,aAAa,OAAO;AAAA,MACjC,gBAAgB,aAAa,OAAO;AAAA,MACpC,YAAY;AAAA,MACZ,OAAO;AAAA,MACP,cAAc,OAAO,OAAO,CAAC,GAAG,kBAAkB,CAAC;AAAA,MACnD,eAAe,aAAa,OAAO;AAAA,IACrC,CAAC;AAAA,EACH,CAAC;AACH;AAGA,eAAsB,8BACpB,UAAwC,CAAC,GACC;AAC1C,QAAM,WAAW,MAAM,8BAA8B,OAAO;AAC5D,QAAM,WAAW,QAAQ,YAAY;AACrC,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,SAAS,cAAc,SAAS,qBAAqB,EAAE,IAAI;AAAA,EAC9E,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,MAAM;AAAA,IACV;AAAA,EACF;AACA,MAAI,OAAO,aAAa,YAAY,aAAa,QAAQ,MAAM,QAAQ,QAAQ,GAAG;AAChF,iBAAa,0DAA0D;AAAA,EACzE;AACA,QAAM,SAAS;AACf,MAAI,QAAQ,OAAO;AACjB,UAAM,QAAQ,MAAM,MAAM;AAAA,EAC5B,OAAO;AACL,qCAAiC,QAAQ,QAAQ;AAAA,EACnD;AACA,SAAO;AACT;AAQA,eAAsB,kCACpB,UAAwC,CAAC,GACD;AACxC,QAAM,cAAc,QAAQ,eAAe,QAAQ;AACnD,QAAM,iBAAiB,QAAQ,kBAAkB,oCAAoC;AACrF,QAAM,SAAS,MAAM,8BAA8B,EAAE,aAAa,eAAe,CAAC;AAClF,QAAM,gBAAgB,MAAM,yBAAyB,OAAO,YAAY,GAAG;AAC3E,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,cAAc,OAAO,YAAY;AAAA,IACjC;AAAA,EACF;AACA,QAAM,UAAU,MAAM,0BAA0B,YAAY;AAC5D,QAAM,QAAQ,MAAM,8BAA8B,EAAE,aAAa,eAAe,CAAC;AACjF,MACE,CAAC,SAAS,QAAQ,KAAK,KACvB,QAAQ,SAAS,YACjB,QAAQ,WAAW,OAAO,UAC1B,QAAQ,kBAAkB,OAAO,OAAO,eACxC;AACA,cAAU,gEAAgE;AAAA,EAC5E;AACA,SAAO,OAAO,OAAO,EAAE,UAAU,OAAO,QAAQ,CAAC;AACnD;AAGO,SAAS,6CAA6C,OAA4B;AACvF,QAAM,WAAW,+CAA+C,KAAK;AACrE,SAAO,IAAI,YAAY,EAAE,OAAO,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,CAAI;AAC1E;AAGO,SAAS,kDAAkD,OAA4B;AAC5F,QAAM,WAAW,4CAA4C,KAAK;AAClE,SAAO,IAAI,YAAY,EAAE,OAAO,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,CAAI;AAC1E;AAEO,SAAS,sCAA6D;AAC3E,QAAM,WAAW,QAAQ;AACzB,QAAM,OAAO,QAAQ;AACrB,MAAI,aAAa,SAAS;AACxB,WAAO,6BAA6B,EAAE,UAAU,KAAK,CAAC,EAAE;AAAA,EAC1D;AACA,SAAO,6BAA6B,EAAE,UAAU,MAAM,MAAM,gBAAgB,EAAE,CAAC,EAAE;AACnF;AAEA,eAAsB,sBACpB,MACA,cAAkC,QAAQ,KACzB;AACjB,QAAM,CAAC,SAAS,QAAQ,GAAG,IAAI,IAAI;AACnC,MAAK,YAAY,YAAY,YAAY,YAAa,WAAW,YAAY,KAAK,SAAS,GAAG;AAC5F,UAAM,IAAI,qBAAqB,qCAAqC,wBAAwB,CAAC;AAAA,EAC/F;AACA,QAAM,WACJ,YAAY,WACR,MAAM,8BAA8B,EAAE,YAAY,CAAC,IACnD,MAAM,8BAA8B,EAAE,YAAY,CAAC;AACzD,SAAO,GAAG,KAAK,UAAU,QAAQ,CAAC;AAAA;AACpC;AAEA,SAAS,0BAAkC;AACzC,SAAO;AACT;AAEA,eAAe,yBACb,MACyF;AACzF,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;AAAA,EAC7E,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,MAAM;AAAA,IACV;AAAA,EACF;AAEA,SAAO,OAAO,OAAO;AAAA,IACnB,UAAU;AAAA,IACV;AAAA,EACF,CAAC;AACH;AAEA,SAAS,qBACP,OACmE;AACnE,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;AAAA,EAC7E,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,MAAM;AAAA,IACV;AAAA,EACF;AACA,SAAO,+CAA+C,MAAM;AAC9D;AAEA,SAAS,+BACP,QACA,UACM;AACN,QAAM,YAAY,6CAA6C,QAAQ;AACvE,MAAI,CAAC,UAAU,QAAQ,SAAS,GAAG;AACjC,cAAU,oEAAoE;AAAA,EAChF;AACF;AAEA,SAAS,oCACP,QACA,UACM;AACN,QAAM,YAAY,kDAAkD,QAAQ;AAC5E,MAAI,CAAC,UAAU,QAAQ,SAAS,GAAG;AACjC,cAAU,yEAAyE;AAAA,EACrF;AACF;AAEA,eAAe,sBAAsB,KAAU,MAAc,MAA+B;AAC1F,QAAM,OAAO,MAAM,cAAc,cAAc,GAAG,GAAG,IAAI;AACzD,QAAM,WAAW,SAAS,MAAM,IAAI;AACpC,MACE,aAAa,QACb,SAAS,WAAW,KAAK,QAAQ,aAAa,UAAU,OAAO,GAAG,EAAE,KACpE,WAAW,QAAQ,GACnB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,cAAc,OAAe,MAA+B;AACzE,MAAI,CAAC,WAAW,KAAK,GAAG;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,MAAI;AACF,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAM,WAAW,MAAM,KAAK,IAAI;AAChC,QAAI,CAAC,SAAS,OAAO,EAAG,aAAY,GAAG,IAAI,wBAAwB;AACnE,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,qBAAsB,OAAM;AACjD,UAAM,IAAI,qBAAqB,gCAAgC,GAAG,IAAI,qBAAqB;AAAA,MACzF;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,eAAe,gBACb,MACA,cACA,MACqB;AACrB,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,KAAK,MAAM,GAAG;AAC7B,UAAM,SAAS,MAAM,OAAO,KAAK;AACjC,QAAI,CAAC,OAAO,OAAO,EAAG,aAAY,GAAG,IAAI,wBAAwB;AACjE,QAAI,OAAO,QAAQ,KAAK,OAAO,OAAO,cAAc;AAClD,gBAAU,GAAG,IAAI,oCAAoC;AAAA,IACvD;AACA,UAAM,QAAQ,IAAI,WAAW,MAAM,OAAO,SAAS,CAAC;AACpD,UAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,QAAI,MAAM,SAAS,OAAO,QAAQ,MAAM,eAAe,OAAO,MAAM;AAClE,gBAAU,GAAG,IAAI,kCAAkC;AAAA,IACrD;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,qBAAsB,OAAM;AACjD,UAAM,IAAI,qBAAqB,gCAAgC,kBAAkB,IAAI,IAAI;AAAA,MACvF;AAAA,IACF,CAAC;AAAA,EACH,UAAE;AACA,UAAM,QAAQ,MAAM;AAAA,EACtB;AACF;AAEA,eAAe,kBACb,MACA,UACA,cACA,MACqB;AACrB,MAAI,SAAS,QAAQ,aAAc,WAAU,GAAG,IAAI,4BAA4B;AAChF,QAAM,QAAQ,MAAM,gBAAgB,MAAM,cAAc,IAAI;AAC5D,MAAI,MAAM,eAAe,SAAS;AAChC,cAAU,GAAG,IAAI,yCAAyC;AAC5D,QAAM,SAAS,UAAU,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AACzE,MAAI,WAAW,SAAS,OAAQ,WAAU,GAAG,IAAI,qCAAqC;AACtF,SAAO;AACT;AAEA,eAAe,WACb,MACA,UACA,cACA,MACe;AACf,MAAI,SAAS,QAAQ,aAAc,WAAU,GAAG,IAAI,4BAA4B;AAChF,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,KAAK,MAAM,GAAG;AAC7B,UAAM,SAAS,MAAM,OAAO,KAAK;AACjC,QAAI,CAAC,OAAO,OAAO,EAAG,aAAY,GAAG,IAAI,wBAAwB;AACjE,QAAI,OAAO,SAAS,SAAS,MAAO,WAAU,GAAG,IAAI,yCAAyC;AAC9F,UAAM,OAAO,WAAW,QAAQ;AAChC,QAAI,QAAQ;AACZ,qBAAiB,SAAS,OAAO,iBAAiB,EAAE,WAAW,MAAM,CAAC,GAAG;AACvE,YAAM,SAAS,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI;AAChE,eAAS,OAAO;AAChB,UAAI,QAAQ,gBAAgB,QAAQ,SAAS,MAAO,WAAU,GAAG,IAAI,uBAAuB;AAC5F,WAAK,OAAO,MAAM;AAAA,IACpB;AACA,UAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,QAAI,MAAM,SAAS,OAAO,QAAQ,UAAU,OAAO;AACjD,gBAAU,GAAG,IAAI,wBAAwB;AAC3C,UAAM,SAAS,UAAU,KAAK,OAAO,KAAK,CAAC;AAC3C,QAAI,WAAW,SAAS,OAAQ,WAAU,GAAG,IAAI,qCAAqC;AAAA,EACxF,SAAS,OAAO;AACd,QAAI,iBAAiB,qBAAsB,OAAM;AACjD,UAAM,IAAI,qBAAqB,gCAAgC,oBAAoB,IAAI,IAAI;AAAA,MACzF;AAAA,IACF,CAAC;AAAA,EACH,UAAE;AACA,UAAM,QAAQ,MAAM;AAAA,EACtB;AACF;AAEA,SAAS,wBAAwB,aAAiC,MAAsB;AACtF,QAAM,QAAQ,YAAY,IAAI;AAC9B,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,gBAAY,GAAG,IAAI,qEAAqE;AAAA,EAC1F;AACA,SAAO;AACT;AAeO,SAAS,oCACd,UACgB;AAChB,QAAM,aAAa,oBAAI,IAAoB;AAC3C,MAAI,SAAS,SAAS,SAAS,IAAI,EAAG,YAAW,IAAI,MAAM;AAC3D,MAAI,SAAS,SAAS,QAAQ,QAAQ,mBAAmB,EAAG,YAAW,IAAI,KAAK;AAChF,MACE,MAAM,QAAQ,SAAS,QAAQ,aAAa,KAC5C,SAAS,OAAO,cAAc;AAAA,IAC5B,CAAC,UACC,OAAO,UAAU,YACjB,wDAAwD,KAAK,KAAK;AAAA,EACtE,GACA;AACA,eAAW,IAAI,MAAM;AAAA,EACvB;AACA,QAAM,iBAAiB;AAAA,IACrB,SAAS,QAAQ,QAAQ,SAAS;AAAA,IAClC,SAAS,SAAS;AAAA,IAClB,SAAS;AAAA,EACX;AACA,MAAI,eAAgB,YAAW,IAAI,cAAc;AACjD,MAAI,WAAW,SAAS,EAAG,QAAO,CAAC,GAAG,UAAU,EAAE,CAAC;AACnD,QAAM,IAAI;AAAA,IACR;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,kBAAkC;AACzC,QAAM,SAAS,QAAQ,QAAQ,UAAU;AACzC,SAAO,oCAAoC;AAAA,IACzC,MAAM,QAAQ;AAAA,IACd,UAAU,QAAQ;AAAA,IAClB,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,EAC7B,CAAC;AACH;AAEA,SAAS,2BACP,WACA,YACA,MAC4B;AAC5B,MAAI,CAAC,SAAS,SAAS,KAAK,CAAC,SAAS,UAAU,EAAG,QAAO;AAC1D,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,SAAS;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MACE,IAAI,aAAa,YACjB,IAAI,aAAa,gBACjB,IAAI,YACJ,IAAI,YACJ,IAAI,UACJ,IAAI,MACJ;AACA,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,8EAA8E;AAAA,IAC1F,IAAI;AAAA,EACN;AACA,MAAI,CAAC,SAAS,MAAM,CAAC,MAAM,WAAY,QAAO;AAC9C,QAAM,gBAAgB,MAAM,CAAC;AAC7B,QAAM,cACJ,SAAS,UACL,oCAAoC,KAAK,aAAa,IACtD,SAAS,QACP,8CAA8C,KAAK,aAAa,IAChE;AACR,MAAI,CAAC,YAAa,QAAO;AACzB,SAAO,cAAc,MAAM,GAAG,EAAE,SAAS,MAAM,IAAI,SAAS;AAC9D;AAEA,SAAS,SAAS,OAAiC;AACjD,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;AAEO,SAAS,iCACd,QACA,UACM;AACN,QAAM,aAAa,OAAO;AAC1B,MAAI,OAAO,eAAe,YAAY;AACpC,iBAAa,uEAAuE;AAAA,EACtF;AACA,QAAM,UAAU,WAAW;AAC3B,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,iBAAa,mEAAmE;AAAA,EAClF;AACA,QAAM,SAAS;AACf,MACE,OAAO,SAAS,YAChB,OAAO,WAAW,SAAS,UAC3B,OAAO,kBAAkB,SAAS,OAAO,iBACzC,OAAO,OAAO,iBAAiB,YAC/B,OAAO,iBAAiB,MACxB;AACA,iBAAa,2DAA2D;AAAA,EAC1E;AACA,QAAM,kBAAkB,OAAO;AAC/B,QAAM,cAAc,OAAO;AAC3B,QAAM,WAAW,OAAO;AACxB,QAAM,UAAU,OAAO;AACvB,MACE,OAAO,iBAAiB,WAAW,cACnC,OAAO,gBAAgB,cACvB,OAAO,aAAa,cACpB,OAAO,YAAY,YACnB;AACA,iBAAa,sEAAsE;AAAA,EACrF;AACA,QAAM,WAAW,gBAAgB,OAAO;AACxC,MAAI;AACF,UAAM,QAAQ,YAAY,QAAQ;AAClC,QACE,MAAM,kBAAkB,SAAS,UACjC,MAAM,yBAAyB,SAAS,OAAO,iBAC/C,OAAO,MAAM,oBAAoB,UACjC;AACA,mBAAa,sEAAsE;AAAA,IACrF;AAAA,EACF,UAAE;AACA,YAAQ,QAAQ;AAAA,EAClB;AACF;AAEA,SAAS,gBAAgB,WAAqC;AAC5D,SAAO;AAAA;AAAA,IAA0B;AAAA;AACnC;AAEA,SAAS,SAAS,MAAe,OAAyB;AACxD,SAAO,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,KAAK;AACtD;AAEA,SAAS,UAAU,MAAkB,OAA4B;AAC/D,MAAI,KAAK,eAAe,MAAM,WAAY,QAAO;AACjD,SAAO,KAAK,MAAM,CAAC,OAAO,UAAU,UAAU,MAAM,KAAK,CAAC;AAC5D;AAEA,SAAS,UAAU,SAAwB;AACzC,QAAM,IAAI,qBAAqB,8BAA8B,OAAO;AACtE;AAEA,SAAS,YAAY,SAAwB;AAC3C,QAAM,IAAI,qBAAqB,gCAAgC,OAAO;AACxE;AAEA,SAAS,aAAa,SAAwB;AAC5C,QAAM,IAAI,qBAAqB,iCAAiC,OAAO;AACzE;","names":[]}